fix(release): correct source and JVM artifacts

[chaokunyang]

Why?

The v1.7.0-rc2 vote identified three release blockers:

1. The ASF source archive contained 11 first-party source/build files without ASF headers.
2. The Java Maven source-release ZIP collected 135 ignored workspace files and its top-level
   LICENSE did not account for bundled third-party-derived source.
3. Four Kotlin Javadoc JARs omitted META-INF/LICENSE and META-INF/NOTICE.

The published RC2 artifacts were compared with tag
5f467b5c4721673eab6dc81fb365c74637c91d29 before changing their owning build paths.

What does this PR do?

• Adds ASF headers to the exact 11 reported first-party files.
• Adds a complete java/LICENSE as the Java source distribution's top-level license, including
  third-party-derived source attribution, and completes fory-core's commons-lang3 attribution.
• Explicitly keeps the project-owned java/LICENSE when Apache's source-release descriptor later
  adds a generated LICENSE with the same archive path. Generated NOTICE and DEPENDENCIES
  continue to come from the Apache parent.
• Runs JVM release publication from a temporary detached worktree at the current HEAD, then
  removes it after success or failure. The caller's build residue cannot enter the release.
• Packages and verifies Java and Kotlin artifacts, cleans the corresponding temporary language
  directory before deploy reruns the lifecycle, and verifies the deployed build output again.
• Requires the Java source-release ZIP to match the exact Git-tracked java/ tree plus Maven's
  generated legal files and its top-level LICENSE to match java/LICENSE exactly.
• Stages the existing Kotlin legal resources into Dokka's output directory and requires exactly
  one META-INF/LICENSE and META-INF/NOTICE in every public Kotlin Javadoc JAR.
• Disables annotation processing only for fory-json's Java 17 Ant execution, whose checked-in
  subtype table intentionally simulates processor output. This fixes the clean JDK 25 release
  build exposed while rebuilding the artifacts.

Related issues

None.

Verification

• Clean detached Java release package with JDK 25:
  mvn -B --no-transfer-progress -T10 clean package -DskipTests -Papache-release
• python ci/release.py verify_java_artifacts: passed before the final license-owner relocation;
  the source-release ZIP contained exactly 950 unique expected files, with no unexpected or missing
  entries, and the same complete license content now stored at java/LICENSE.
• Transformed source archive inspection: all 11 reported first-party files contain ASF headers.
• Clean detached Kotlin release package with JDK 25:
  mvn -B --no-transfer-progress clean package -DskipTests -Papache-release
• python ci/release.py verify_kotlin_artifacts: passed for all four public Kotlin artifacts; each
  Javadoc JAR contained exactly one META-INF/LICENSE and META-INF/NOTICE.
• python -m ruff format ci/release.py, python -m ruff check ci/release.py, and
  git diff --check: passed.

No build or test was run after relocating the already-inspected license content to java/LICENSE,
per contributor instruction. The final change affects only release-file ownership and packaging.

Does this PR introduce any user-facing change?

• Does this PR introduce any public API change?
• Does this PR introduce any binary protocol compatibility change?

Benchmark

N/A. This PR changes release packaging and validation only.